CVE-2026-68350

wifi: carl9170: fix OOB read from off-by-two in TX status handler

State: Published
Severity: Not scored
Published: Aug 10, 2026
Updated: Aug 19, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: carl9170: fix OOB read from off-by-two in TX status handler

The bounds check in carl9170_tx_process_status() uses `i > ((cmd->hdr.len / 2) + 1)` which is off by two, allowing 2 extra iterations past valid _tx_status entries when the firmware- controlled hdr.ext exceeds hdr.len/2. Fix by using the correct comparison `i >= (cmd->hdr.len / 2)`.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 9bf8d8510b7bed20320dead0f8cdcf8e610ec8dbAffected a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 2c030c20f112bd8f6aa59d09501835605f01bf9dAffected a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 73462e8e602047a03e538d971a79ad67a4ba9a5dAffected a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 7ed0dce8613c92111d2a3836ced2ab03190ba20eAffected a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before e8a862a3da457ddc50633c346dc645d559da09aeAffected a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before fab6ff91d5b8c4af62e2ced42fb357fa3eb9fd59Affected a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 423c836f934814b8fdbe53b24a79d021a0ee8454Affected a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before a3f42f1049ad80c65560d2b078ad426c3134f78dAffected
LinuxLinux	2.6.37Affected before 2.6.37Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 9bf8d8510b7bed20320dead0f8cdcf8e610ec8dbAffected
a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 2c030c20f112bd8f6aa59d09501835605f01bf9dAffected
a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 73462e8e602047a03e538d971a79ad67a4ba9a5dAffected
a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 7ed0dce8613c92111d2a3836ced2ab03190ba20eAffected
a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before e8a862a3da457ddc50633c346dc645d559da09aeAffected
a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before fab6ff91d5b8c4af62e2ced42fb357fa3eb9fd59Affected
a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before 423c836f934814b8fdbe53b24a79d021a0ee8454Affected
a84fab3cbfdc427e7d366f1cc844f27b2084c26c to before a3f42f1049ad80c65560d2b078ad426c3134f78dAffected

LinuxLinux

2.6.37Affected
before 2.6.37Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.